In motor vehicles, control units are increasingly used for the control and/or regulation of particular functions of the motor vehicle. The motor vehicle functions that are to be controlled or regulated range from pure comfort functions (e.g., climate control, electric windows, electric sunroof actuation, etc.) to functions for operating the motor vehicle (e.g., functions of an internal combustion engine, of an exhaust gas purification system, of a transmission, etc.), to safety-related functions (e.g., functions of a brake system (anti-lock braking or ABS), dynamics of vehicular operation (electronic stability program, ESP), X-by-wire applications (electronic braking, electronic steering), etc.).
In control units for safety-related functions, it should be ensured that when there are malfunctions of the control program running on the control unit, no critical state of the motor vehicle function to be controlled via the output stage may occur. If program malfunctions are detected, the control unit should be switched over to limp-home operation, or should be switched off entirely. However, a precondition of this is the availability of a reliable function monitoring of the control unit.
Control units have a main computing element having at least one microprocessor. So that the control unit can fulfill its normal controlling and/or regulating function, a control program is run on the microprocessor. The control program is stored on a memory element of the main computing element. For the execution of the control program, this program is transferred either in segments or as a whole to the microprocessor, and is run there. In addition, many control units have at least one auxiliary computing device that includes, for example, a coprocessor. In contrast to the main computing element, which can be used universally, the auxiliary computing element is optimized for particular computations. The auxiliary computing element supports the main computing element in the running of the control program by executing, for example, particular computations (e.g., numeric or mathematical computations of a mathematical coprocessor) that occur in the context of the running of the control program.
Published German Patent Document No. 41 14 999 describes a control unit that has, in addition to the main computing element, a separate monitoring device that checks whether the main computing element is operating in error-free fashion. If a malfunction of the main computing element is detected, a reset of the overall control unit is triggered, or one or more output stages affected by the malfunction are locked. The malfunction of the control unit is detected in that from time to time data that must correspond to a particular pattern are exchanged between the main computing element and the monitoring device.
In published German Patent Document No. 100 63 449, a method is described for monitoring the functioning of a control unit, in particular for monitoring the consistency of interrupts. The control unit includes a main computing element that is formed as a CPU, and an auxiliary computing element in the form of a coprocessor. The auxiliary computing unit evaluates impulses that are produced by a hardware device (e.g., by an incremental angle encoder system), and generates, on the basis of the impulses, the interrupts for the main computing element. This latter device calculates a sampling time on the basis of the interrupts. In order to monitor consistency, the auxiliary computing element calculates a segment time, and transfers it together with the interrupt to the main computing element, which compares the received segment time with the calculated sampling time.